Digital Certificates
Subtechnique · ATTACK:enterprise:T1588.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1588.004",
"title": "Digital Certificates",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1588/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--19401639-28d0-4c3c-adcc-bc2ba22f6421",
"external_id": "T1588.004",
"domain": "enterprise",
"created": "2020-10-01T02:14:18.044Z",
"modified": "2025-10-24T17:48:27.525Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"resource-development"
],
"source_references": [
{
"source_name": "DiginotarCompromise",
"url": "https://threatpost.com/final-report-diginotar-hack-shows-total-compromise-ca-servers-103112/77170/"
},
{
"source_name": "Recorded Future Beacon Certificates",
"url": "https://www.recordedfuture.com/research/cobalt-strike-servers"
},
{
"source_name": "Splunk Kovar Certificates 2017",
"url": "https://www.splunk.com/en_us/blog/security/tall-tales-of-hunting-with-tls-ssl-certificates.html"
},
{
"source_name": "Let's Encrypt FAQ",
"url": "https://letsencrypt.org/docs/faq/"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1056 → mitigates → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d600c05-c617-46f4-947f-cdd6ca56d494
ATTACK:enterprise:G0122 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a2119a2-6a39-4062-b90c-bffd15b259ec
Phish Labs Silent Librarian · Secureworks COBALT DICKENS September 2019ATTACK:enterprise:C0043 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--36d8e644-f808-436c-84d0-460b2bbf1c9b
RecordedFuture RedEcho 2022ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41c193c1-8269-4a2e-9ed8-9dd51489a03f
CISA AppleJeus Feb 2021ATTACK:enterprise:T1588.004 → subtechnique-of → ATTACK:enterprise:T1588
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b23ce54-a782-4af5-99bd-8bc59c2893b2
ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5063d844-fd04-478e-8812-399ba4e7fa58
Talos Sea Turtle 2019 · Talos Sea Turtle 2019_2ATTACK:enterprise:G0129 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74cd7fa0-af3f-4f50-ba66-b479b57f8a74
EclecticIQ Mustang Panda PlugX · Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--970ed37e-d468-40cf-a6c4-b6dfce5a1c4b
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:C0006 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--989a5b4d-14d3-4942-8326-91d677e4d38a
McAfee HoneybeeATTACK:enterprise:C0047 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b509cd54-97dc-4d27-b632-bcae388e09e6
Recorded Future RedDelta 2025ATTACK:enterprise:G1014 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea4a70c8-5952-4a61-86a2-bdc801a64dc8
Kaspersky LuminousMoth July 2021ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1588.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff9691d7-91dd-4549-b997-d5abf327ef1f
ESET PLEAD Malware July 2018